5.1.1. Catalogs and Access Packages
💡 First Principle: Delegation needs containers. A catalog bundles related resources and hands non-admins the power to build packages from those resources only — the IT-owned resource boundary inside which business owners self-serve.
Catalogs hold resources: security/M365 groups, enterprise applications, and SharePoint Online sites. Catalog roles delegate safely: a catalog owner (e.g., the Marketing lead) manages the catalog and its packages without any directory role; resources must be added to the catalog before any package can offer them — that addition is the governance chokepoint IT retains. A catalog's enabled for external users flag controls whether its packages can be requested from outside.
Access packages are the requestable product: a set of resource roles (member of these groups, assigned to this app in this app role, member of this site) plus one or more policies answering: who can request (specific users/groups, all internal users, specific connected organizations, or any external user), what approval looks like (none, single stage, multi-stage — e.g., manager then resource owner — with alternate approvers and decision timeouts), whether requestor justification is required, and — the lifecycle heart — expiration (assignment ends after N days or on a date; extensions can require re-approval) plus optional embedded access reviews of the package's assignments. Packages can be hidden (link-only) and support direct assignment by admins for exceptions.
Design intuition the exam rewards: model packages around scenarios ("Contractor — Project Falcon," "New hire — Sales") rather than individual resources; let expiration do the offboarding; delegate package management to catalog owners so central IT governs the resource boundary, not every request.
⚠️ Exam Trap: Resources must exist in the catalog before a package can include them, and catalog owners can only work within their catalog — "the package creator can't add the app" stems resolve by adding the app to the catalog (an IT/catalog-owner act), not by granting directory roles.
Reflection Question: Why does routing project access through a 90-day-expiring package beat adding people to the three underlying groups directly — name the offboarding, audit, and delegation wins.
